The present invention relates to computers used in critical applications where it is important to be able to guarantee the integrity of the data produced. It applies to redundant computers with several parallel computing units monitored by a circuit based on comparison or majority voting. The parallel computing units include processors which are independent of each other, running, in parallel and at the same speed but under the control of independent and therefore asynchronous clocks, the same applications parameterized with the same initial data, while the comparison or majority voting circuit only allows the output of data which are found to be identical or of which a majority are found to be identical in the various parallel channels.
Implementing the redundancy principle involves comparing the results supplied by the processors in the various computing units for the same processing stage in the same application with the same initial parameterization. In order to achieve this, the processors in the different computing units are programmed to run the same application in parallel, at the same speed and with the same parameterization. Due, however, to the independence of their clocks and the asynchronous processing of interrupts, they have a natural tendency to become desynchronized and this must be compensated for by an appropriate level of relaxed synchronization.
The complexity of modern processors, the fact that they take into account variable-length instructions from a queue held in cache memory and the difficulties engendered by processing interrupt requests formulated asynchronously relative to the execution of instruction sequences in an application make it difficult to achieve synchronization by predicting the states of the microprocessors at a given instant solely on the basis of knowing the sequence of instructions in the application that is running, its initial parameterization and the time elapsed since execution began.
U.S. Pat. No. 5,896,523 teaches that it is possible to circumvent this problem by making use of a programmable instruction counter in the processors in order to periodically resynchronize processors running in parallel the same application parameterized with the same initial data by making them execute, at the end of a time interval approximately corresponding to the processing time for a predefined number or quantum of instructions, a synchronization procedure based on the number of instructions processed appearing in the instruction counters and called by means of a synchronization interrupt request. When the synchronization interrupt request is accepted by a processor, the synchronization procedure results in the following:                the processor concerned signals to the other processors the contents of its processed-instruction counter;        the processor concerned compares the number of instructions processed appearing in the instructions-processed counters from the various processors after they accepted the synchronization interrupt; and        
if the numbers of instructions processed are found to be identical,                the processor concerned issues a synchronization confirmation;        
while if the numbers of instructions processed are different,                either the processor concerned enters a wait state if its processed-instruction counter indicates the largest number and the comparison is repeated for each new exchange of numbers of instructions-processed counters with the other processors,        or the processor concerned executes a procedure of processing the instructions step-by-step until its processed-instruction counter reaches the highest number and then the processor concerned sends to the other processors an updated value of its number of instructions processed, with renewal of the comparison.        
This relaxed synchronization process between the redundant processors of a fault-tolerant computer does not respond to the severe operating security constraints of a multi-tasking time-sharing computer intended for use in avionics, which has to be deterministic and ensure strict compliance with the time slices allocated to the various applications. There is indeed no reason why the time slices allocated to the various applications should correspond to the same quantum of instructions hence it does not guarantee synchronization of the processors at the end of each time slice at the time of saving the context of the provisional end of processing of the application the execution of which is to be interrupted. Furthermore, systematic resynchronization at each quantum of instructions processed does not follow the increasing risk of desynchronization suffered by the redundant processors in the computer on interrupt requests by system calls. In addition, to ensure good synchronization this technique will generate a number of synchronizations which is systematically greater than that strictly necessary, with a consequent reduction in the performance available for applications.